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Fingerprinting enables two parties to infer whether the messages they hold are the same or differ- 
ent when the cost of communication is high: each message is associated with a smaller fingerprint 
and comparisons between messages are made in terms of their fingerprints alone. In the simulta- 
neous message passing model, it is known that fingerprints composed of quantum information can 
be made exponentially smaller than those composed of classical information. For small message 
lengths, we present constructions of optimal classical fingerprinting strategies with one-sided error, 
in both the one-way and simultaneous message passing models, and provide bounds on the worst- 
case error probability with the help of extremal set theory. The performance of these protocols 
is then compared to that for quantum fingerprinting strategies constructed from spherical codes, 
- - - , equiangular tight frames and mutually unbiased bases. 
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1—5 . I. INTRODUCTION 

Consider the following scenario. Alice needs to send an important message to Bob. She does not mind if an 
' intermediary party reads this message while in transit, but does however, require that the message remains unchanged. 
Alice considers broadcasting her message through a trusted public communication channel, her local radio station, 
but alas, access time is very expensive and her message is long. Instead she proceeds by sending it across untrusted 

■ communication channels, over the internet, which are inexpensive and plentiful. Alice is now faced, however, with the 
' possibility that a saboteur has surreptitiously intercepted and changed part, or all, of her message. To test its integrity, 
. she reluctantly reconsiders buying airtime at her local radio station. Alice's transmission costs now depend on the 

■ level of risk she is prepared to tolerate, for a corrupted message to pass undetected. An absolute guarantee of integrity 
, requires Alice to transmit her entire message again, this time through the trusted channel. If however, she is willing 

(~| ' to tolerate a small probability of detection error, a considerably smaller piece of information, called a fingerprint, need 
0^1 only be sent. Alice could, for example, broadcast only the first byte of her message. This strategy is said to have 
I ' . . one-sided error: when the first byte does not match that for Bob's copy, Alice knows with certainty that foul play has 
^ ' occurred. Unfortunately, since it is Bob who must perform the comparison, and no private communication channel is 
^ , available, we are forced to assume that Alice and Bob use a strategy which is publicly known. An adversary will now 
simply avoid corrupting the first byte, while playing havoc with the rest. There is, of course, a simple workaround: 
Alice instead broadcasts a random byte of her message, chosen by flipping a private coin, together with the location 
of this byte. Assuming the availability of a trusted, though costly, broadcast channel, Alice has thus obtained a level 
of security through only public communication. In a probabilistic sense, message sabotage will never go undetected. 
Although motivated in terms of message authentication, the preceding protocol is called fingerprinting. In all 
] generality, fingerprinting enables separated parties to infer whether the messages they hold are the same or different 
when the cost of communication is high: each message is associated with a smaller fingerprint, and comparisons 
between messages are made in terms of their fingerprints alone. In the above authentication scheme, the messages 
were compared using one-way communication, from Alice to Bob. It is known from the theory of communication 
complexity 0,0, that in the limit of long messages, it is sufficient, and necessary, for Alice to communicate finger- 
prints of length (d{logN) bits, for messages of length TV bits, if a small constant error probability is allowed. This 
error probability can then be made arbitrarily small through repeated use of the protocol. In another model of com- 
munication complexity, called the simultaneous message passing (SMP) model 0, the fingerprints are transmitted by 
both Alice and Bob, but this time to a referee, who decides the outcome of the message comparison. In this case it 
is sufficient, and necessary, for Alice and Bob to communicate fingerprints of length Q{\/N) bits if the error is to be 
kept arbitrarily small 0, 0, ■ 

We will study both communication models by considering the following generalized scenario. A supplier, who 
we call Sapna, chooses two messages, x and y, from a pool of n unique messages and hands them to Alice and Bob, 
respectively. Alice and Bob are now tasked with determining whether the messages they hold are the same or different. 
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They are forbidden direct communication, however, but instead allowed to correspond with a referee, called Roger. As 
communication is considered expensive, Alice and Bob are limited to sending fingerprints of their original messages, 
a and b respectively, which they select from smaller pools of size mA and ruB- Roger then infers 



and completes the protocol by announcing a single bit z e {0,1}. Roger is correct if z = EQ(a;,y). In the current 
investigation we are concerned only with one-sided-error protocols, in which case, z = is allowed only iix ^ y. Then, 
when Roger announces 0, Alice and Bob can conclusively claim that the messages are indeed different. Protocols 
with one-sided error are of vital practical importance whenever the cost of false negative results outweighs that of 
false positives. This is the case when x and y are in fact expected to be equal. In the above authentication scheme, 
the one-sided-error condition means that Bob will always accept an uncorrupted message as authentic, and thus, 
transmission throughput remains unaffected when an adversary is not present. 

The fingerprinting protocol adopted by Alice, Bob and Roger is publicly announced. The goal of this protocol is to 
minimize Roger's error probability. Sapna, however, may be a saboteur, and always choose message pairs that lead 
to the highest error rate in Roger's output. We thus evaluate fingerprinting protocols according to this worst-case 
scenario. The worst-case error probability, Pwco — max^^^j^ Prob(z ^ EQ(a;,?/)), then corresponds to the maximum 
error rate, and provides an absolute guarantee on the performance of the protocol. 

Note that the one-way communication model is realized when ms = n, in which case Bob has the same number of 
fingerprints as Sapna has messages, and may simply pass on y to Roger. Bob and Roger may now be thought of as the 
same party. The simultaneous message passing model is realized when niA ^ ras- We are concerned with the small 
message limit, however, where it makes more sense to analyze both models within the above general scenario. One 
could also consider a model where two-way communication between Alice and Bob is allowed. The added possibility 
of multiple communication rounds, however, would make the analysis of this model considerably more complex. We 
thus exclude this case. 

Quantum fingerprinting protocols 0, 0i IS allow each classical fingerprint to be replaced by a quantum state. 
For a fair comparison, the quantum fingerprints are drawn from a Hilbert space of dimension equal to the number 
of available classical fingerprints. That is, instead of drawing from sets of size tua and ms, respectively, Alice and 
Bob draw their quantum fingerprints from Hilbert spaces of dimension iua and ms. In the simultaneous message 
passing model it is known that fingerprints composed of quantum information can be made exponentially smaller 
than those composed of classical information. Specifically, for messages of length N bits, it was shown by Buhrman et 
al. that fingerprints composed of &{logN) qubits are sufficient, and necessary, to keep the error arbitrarily small. 
This exponential resource advantage is not apparent in the one-way communication model, where the classical and 
quantum complexities are equal. 

In the current article we will investigate optimal fingerprinting strategies in the small message limit. We will present 
specific constructions of classical fingerprinting strategies which derive from constant-weight codes, and provide lower 
bounds on the worst-case error probability with the help of extremal set theory. These bounds define error rates 
which quantum protocols must surpass in order to claim a definitive adva ntag e over classical protocols, and are 
thus important for current experimental tests of quantum fingerprinting |lCl lll| . In most cases the aforementioned 
classical fingerprinting strategies are optimal, having error rates that meet a lower bound. Our results for classical 
fingerprinting will be contained in Sec. ^ which is further subdivided into a preliminary discussion to set notation, 
an indepth study of fingerprinting under the one-way communication model, and a study of general fingerprinting 
which concentrates on the SMP model. In Sec. IIIII we will investigate the extent at which classical strategies are 
outperformed by quantum fingerprinting strategies. Constructions of quantum strategies will be presented which 
derive from spherical codes, equiangular tight frames and mutually unbiased bases. Finally, in Sec. llVl we summarize 
our results. 



It will prove useful to think of Alice, Bob and Roger forming a team with the common goal of minimizing Roger's 
error probability, and Sapna operating as their opponent. This team uses a pre-established, publicly known protocol. 
In this protocol, Alice and Bob have a fixed probability of communicating each fingerprint pair (a, b) to Roger for 
given message pair (x, y) provided by Sapna. Furthermore, Roger has a fixed probability of declaring x and y to be 
the same message upon receipt of fingerprint pair (a, b). 




(1) 



II. CLASSICAL FINGERPRINTING 



A. Notation and preliminary results 
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Any classical fingerprinting protocol is completely specified by three functions: p : {1,. . . , itia} x {1, . . . , n} ^ [0, 1], 
q : {1, . . . , uib} X {1, . . . , n} ^ [0, 1] and r : {1, . . . , uia} x {1, . . . , tob} — *■ [0, 1]. The function p{a\x) is the probability 
that Alice sends fingerprint a to Roger, given that she receives message x from Sapna. Similarly, q{b\y) is the 
probability that Bob sends b to Roger, given that he receives y from Sapna. The function r(a, b) is the probability 
that Roger outputs z — 1, given that he receives fingerprint a from Alice and b from Bob. 

We will call the triple (p, q, r) a strategy. When a party's private strategy (i.e. p, q or r) takes values only in the set 
{0, 1}, we call that party's strategy deterministic. If all parties' strategies are deterministic we call the triple {p^q,r) 
a deterministic strategy. Otherwise a general (i.e. probabilistic) strategy should be assumed. Normalization requires 

TTOA rUB 

^p(a|x)=^g(6|y) = l (2) 

a=l 6=1 

for all X and y. 

Given a strategy (p, q, r), the probability that Roger outputs 1 when Sapna deals x to Alice and y to Bob is 

p(^''^''-)(a;, y) s ^p(a|a:)<z(fe|y)r(a, b) . (3) 

A strategy is said to have one-sided error when 

Pi^'''''\x,x)^l (4) 

for all X. Using such a strategy, it is impossible for Roger to announce when Sapna has supplied Alice and Bob with 
identical messages. 

Defining the error probability 

the average error probability is then 

and the minimum achievable average error probability is 

^ave(n, TUA, ms) = min Pi^'^-'^) , (7) 

where the minimum is taken over all strategies. If, however, the minimum is restricted to only those strategies with 
one-sided error, we use I^l^^{n, ttia, rag) to denote the corresponding minimum achievable average error probability. 
It is this second quantity which will be of interest in the current article. The results of Horn et al. immediately 
give us our first result: 



Theorem 1. 



, , k\n/rri\'^ + (m — k)\n/m\'^ — n 

mA. me) = ^ ^ 2 («) 



where m ~ m\n{mA,mB} and k — n mod m. 

When niA — ms — rn the proof of Theorem^foUows immediately from Lemmas 2 and 3 of [l^ . The last paragraph 
in Sec. 2 of explains how to deal with the general case. The strategy which achieves the optimal error probability, 
given by Eq. (20) of [3, is in fact deterministic. 

Although the average error probability is a perfectly legitimate measure of the performance of a fingerprinting strat- 
egy, we will consider the worst-case error probability in this article, which corresponds to the guaranteed performance 
of a strategy. The worst- case error probability is simply the largest error probability that Sapna can coerce: 

Pi,P,r)^max P^^-'-)(x,2/). (9) 
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Similar to the above, we define the minimum achievable worst-case error probability 

^wco(n, rriA, m,B) = min P^ct?^''^ = min max P'f^'i^''\x, y) , (10) 

and denote by ,!3^^j.(,(n, m^i, m^) the minimum achievable worst-case error probability when restricted to one-sided- 
error strategies. Our objective in the following sections is to find bounds on this second quantity. 

To begin, let us introduce a lemma that allows the following simplification. Whereas Roger can use a probabilistic 
strategy, we show that there exists a deterministic strategy for Roger, that is at least as good as all probabilistic 
strategies. 

Lemma 2. Let (p,q,r) be a fingerprinting strategy with one-sided error. Then 

P^'''''-Hx,y) > P^P'-^'^^'H^^y) (11) 

for all X and y, where 

I, f 1, if pfala:) > and q(6|a;) > for some x 



erwise 



The proof of this lemma is straightforward and follows from enforcing the one-sided-error constraint [Eq. , by 
setting r'{a,b) = 1 for each appropriate fingerprint pair (a, 6), and then choosing r'{a,b) = in the remaining cases 
for optimality We define a binary strategy {p, q, r) to be one where r = r' , as determined by Eq. (|12|l . All binary 
strategies have one-sided error, and due to Lemma[51 our search for optimal one-sided-error strategies will be limited 
to this type. Each particular binary matrix r{a, b) can be thought of as defining a class of possible strategies for Alice 
and Bob, i.e. those strategies p and q which do not contradict Eq. (|12|l . In the following sections we will decide which 
choices for r{a, b) are best. 



B. One-way model: ms = n 



The simplest non-trivial examples of classical fingerprinting occur when = n, in which case Bob may simply 
pass on y to Roger. In general, when ms = n we will always set tua = ™, Q{b\y) — Sby, and then refer to the strategy 
only by the pair [p, r) . A binary strategy is then one with 

r(a x)-/ 1' ifp(«|2^)>0 (13) 
^ ' ' 1 0, otherwise ' ^ ' 

and thus, Alice's decisions will determine Roger's. Alternatively, we may think of Roger's binary decision matrix, 
r{a,x), as specifying a class of strategies with p{a\x) > whenever r(a, x) = 1, and otherwise. Our job is to then 
minimize the worst-case error probability 

Pt:^=m^xPi^-'-\x,y) (14) 

over all such members of this class, where 



p(^''')(x,y)=^p(«Wr(a,2/). (15) 

a=l 

We first investigate cases where the values of m and n restrict all strategies to those with PXctT'' = 1. First note 
that given '^aPi'^l^) ~ 1 ^^'^ '''(^' v) — 1' ^^^^ have Pi{x, y) — 1 it and only if r(a, y) — 1 whenever p{a\x) > 0, or, 
for binary strategies, r{a,y) = 1 whenever r(a,x) = 1. Defining index sets for Alice's fingerprinting strategy 

/iP)^{ab(a|x)>0} , (16) 

which specify Roger's decisions 

^ ' ' 1 0, otherwise ' ^ ' 



we have a straightforward lemma. 
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TABLE I: Known values of T{m,q), the largest q-cover free family in 2'™', or a lower bound when unknown. 

Lemma 3. Let {p, r) be a binary fingerprinting strategy. Then P^c"^ = 1 iff J^^'' C J^^-* for some x ^ y. 

We now restate Lemma O in the language of extremal set theory IT^ ITsj l. Roger's decision matrix may be 
specified by the set I^^*^ = {/i;^' | a; = !,...,».} which is a subset of the power set 2'^^\ where [m\ = {!,..., m} is 
called the m-set. A /c-subset of a set X is simply a subset of X with cardinaUty fc, and the set of all such subsets will 
be denoted by the symbol (^). Define an antichain A of the poset {S, C) to be a subset of S with the property that 
no two members are comparable via the relation C , i.e. X <^Y ioi all distinct X,Y G A. The length of the antichain 
is its cardinality, \A\. The following is now equivalent to Lemma |3| 

Lemma 3'. Let {p,r) be a binary fingerprinting strategy. Then P^c'c ^ < 1 iff X^^^ is an antichain of length n in 
(2[™1,C). 

An example of an antichain is 2}, {1, 3}, {1, 4}, {2, 3}, {2, 4}, {3, 4}}, which is also the largest antichain in 2^, 
and most easily represented through its binary incidence matrix: 

12 3 4 
110 
10 10 

10 1 . (18) 
110 
10 1 
11 

In our case this incidence matrix is in fact r{a,x), where a indexes the columns and x the rows. The above antichain 
has length 6. In general, the length of the largest antichain in 2[™1 is (|^^2j)' This result is due to Sperner and 
gives us our first important theorem: 

Theorem 4. ^i,,(7i,m,n) < 1 iffn< (l„;^2j) . 

When m < n < (|^^/2j) optimal strategy can be found by first collecting all antichains of length n, and then for 

each such candidate for J''P\ minimize P^ctT'' over Alice's transition probabilities p{a\x) to locate the optimal choice. 

Consider the case when n = (^^"2]) ^'^^ example. If m is even, the set of all m/2-subsets of the m-set, (,["^2)' 

only antichain; if m is odd, the sets {(^jy}l^iy2) ^'^^ ((m+i')/2) ^^'^ only antichains |l3lll7| |. In both cases an optimal 

strategy follows from choosing X^^"' = {llf'' \ x = 1, . . . — and then p{a\x) = l/[m/2j when a G Ljf^ (and 

zero otherwise). For example, when to = 4 and = (2) — 6 the above antichain [Eq. H18() ] is the only choice, in 

which case setting p{a\x) = r{a,x)/2 is optimal, resulting in P^c"^ = 1/2. In general, the resulting worst-case error 
probability is stated in the following proposition. 

Proposition 5. 3^l^^{n,m,n) = 1 - l/[m/2\ if n ^ {[„T/2i) ■ 

Searching for antichains is computationally expensive except for small to and n. We instead turn our attention 
to deriving upper and lower bounds for , ^,!,^„ (n, to, n). Lower bounds follow from generalizing the concept of an 
antichain to a /c-cover free family of sets 0,1^. A family of sets is simply a set of sets. We call the family JT, k-cover 
free when X ^ Yi U • • • U Yfc for all X, Fi, . . . , Y/j e where X Yi for all i. Note that a 1-cover free family is an 
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antichain. The following incidence matrix specifies an example of a 2-cover free family. 

123456789 
1 1 1 
1 1 1 

1 1 1 

1 1 1 
1 1 1 

1 1 1 (19) 

1 1 1 
1 1 1 

1 1 1 

1 1 1 
1 1 1 
10 10 10 

Suppose that Alice uses a strategy where l!f^ C ly^^ U li^^ for some x y,z. Then, for one choice between the 
message pairs {x,y) and {x,z), Sapna will be able to coerce an error probabihty of 1/2 or greater. This follows from 
the inequality 

m m 

Pi(^'''^(x,y)+P^'"^(a;,z) = ^p(a|x)[r(a,y)+r(a,z)] > Y.p{a\x)r{a, x) = 1, (20) 

a— 1 a— 1 

since the assumption /i^-* C ijf'' U li^^ implies that cither r{a,y) — 1 or r{a, z) — 1 when r{a,x) = 1. Thus the 
worst-case error probability may be less than 1/2 only when 1*^^^ is a 2-cover free family. This observation, in its 
generalized form, is the content of the following lemma. 

Lemma 6. Let (p, r) be a binary fingerprinting strategy. Then Pw^iT'' < 1/fc only if 2^^^ is a k- cover free family of 
size n in 2 1™! . 

Unlike in the case of antichains, the size of the largest A:-cover free family in the power set 2[™1 is a difficult problem, 
and consequently, unknown except in a few special cases. Nonetheless, let us denote this number by T{m,k). The 
following theorem then applies. 

Theorem 7. ^l^^{n,m,n) > 1/fc if n > T{m,k) . 
Corollary 8. ^i,,(n,™,n) > 1/fc tf (l) > (^J^^j) • 

The corollary follows from the fact that a family is fc-cover free only if the set {Yi U • • • U Yfe | distinct Fi, . . . , Yfe G 
forms an antichain. The obtained bound, however, may be tightened by calculating the exact value of T(m,fc). 
This problem is also known under the name 

o^super^mposed codes M- In fact, each fc-cover free family of sets T is 
equivalent to a superimposed code, in which the binary incidence vectors corresponding to members of form the 
codewords. The exact value of T(rn, fc) is known when fc = 1, in which case Sperner's result for the largest antichain 
applies, and for the following special cases. Tables from [2ll | show that T{m, 2) — m when to < 8, and T{m, k) — m 
when TO < 15 and fc > 3. Also, our own computational searches have found that r(9, 2) = 12 and T(10, 2) = 13. 
These results are tabulated in Table |l] (integral g), and give many of the lower bounds in Table UTI for ^^^.^,(72, to, n). 

We can generalize Theorem[7|by introducing the concept of a multiset. A multiset is like a set, except that repeated 
elements are now allowed, e.g. X — {1, 1, 2, 3}. Multiset operations then differ from set operations in a straightforward 
way: X \J {2} = {1, 1, 2, 2, 3}, X n {1, 1, 2, 2} = {1, 1, 2}, and {1, 1} <Z X but {1, 1, 1} ^ X. Let X denote the 
multiset union of j copies of AT. A family of sets J- will be called k/j -cover free when X ^ Yi U • • • U Y/c, under 
multiset operations, for all A, Yi, . . . , Yk G T, where X ^ Yi for all i. Note that a family of sets is g-cover free for all 
rationals q < p whenever it is p-cover free. An example of a 3/2-cover free family is the set ('2^). 

Lemma 9. Let {p,r) be a binary fingerprinting strategy. Then P^ctT^ < 1/? only if X^^^ is a q- cover free family of 
size n in 2['"1 . 
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TABLE II: ^wcc('^) "^i n), the minimum achievable worst-case error probabiUty for a classical fingerprinting strategy under the 
one-way communication model, or the range of possible values when unknown. 



This lemma follows from a straightforward generalization of Eq. H2U|) : Suppose now thatU^/i^^ C4?)u...u4f, 
under multiset operations, for some x ^ yi, . . . ,yk- Then 

m 

p(^''^\a:,yi) + ... + p(^''-\x,yfc) = ^p(a|a:) [r(a, j/i) + • • • + r(a, y^)] (21) 

a^l 

> jY,P{a\x)r{a,x) (22) 

a=l 

= J , (23) 

since the condition C U • • • U means that r{a,yi) = 1 whenever r(a,.x) = 1 for j different choices of 

1 < I < k. Equation (|23|l implies that P^''''^\x,yi) > j/k for at least one I, and thus the worst-case error probability 
can be less than j/k only when X'^p'^ is a fc/j-cover free family. 
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For rational q, if we let T(m, q) denote the size of the largest q-cover free family in the power set 2^" 
generalizes to the following. 

Theorem 10. ^l,^^{n,m,n) >l/q if n > T{m,q) . 



1 , then Theorem!?! 



Our own computational searches have found that T{m,3/2) = (™) for m <7, which is also tabulated in Tabled 
and gives the corresponding lower bounds on 3^l^^^{n, m, n) in Table ITll This formula, however, is unlikely to be true 
in general. 

We obtain an upper bound on ^l,^^(n , m, n) whenever a particular example strategy is found. Consider those 
derived from constant weight codes |22l l2,1|. Recall that the weight of a binary vector u — is wt(M) = Ui, 

and the Hamming distance between two vectors u and v is d{u,v) — [""j ~ The code-theoretic function 
A(ri, d, w) is defined as the maximum possible number of binary vectors of length n, Hamming distance at least 
d apart, and constant weight w. If we let N{m,k,j) denote the maximum number of /c-subsets of the m-set with 
pairwise intersections containing j elements or less, then N(rn, k,j) = A(rn, 2(k—j), k). We can see this by considering 
the codewords as incidence vectors for subsets of the m-set, thus defining the isomorphism / : {0, 1}™ — > 2[™1 by 
f{u) = {i\ui = 1}, and noting that d{u, v) — 2{k — \f{u) D f{v)\) when wt(it) = wt{v) = k. Now given a family !F, 
of n fc-subsets of the m-set with pairwise intersections containing j elements or less, we may construct a strategy with 
Pwce^ < j /k by uniquely assigning each index matrix ijf^ (x — 1, .., n) with a member of and setting p{a\x) — 1/k 

when a G I'^J'^ (and zero otherwise). Thus ^^(,g(n,m,n) < j/k whenever n < N(rn,k,j) — A{m,2{k — j),k), which 
is restated in the following theorem. 



Theorem 11. 



wcc 



{n,m,n) <j/k if n < N{m,k,j) ^ A{m,2{k - j), k) 



In some cases A{n, d, w) is known exactly |23|. Examples are N{m, k,k — 1) — A{m, 2, k) 



which is trivial, 



7V(m,3, 1) = A(m,4,3) 



-JJ, if m ^ 5 mod 6 
— 1, if m = 5 mod 6 



(24) 



and 



N{q^,q,l)^A{q\2q-2,q)=q{q+l) 



(25) 



if g is a prime power. These results give the upper bounds on ^^^^{n, m, n) in Table !n Thus far, we do not know 
of a strategy with smaller worst-case error probability than that attained by a constant-weight-code strategy. 

Finally, we remark that the inequalities ^^^^{n -I- 1, m, ti + 1) > ^^^^{n, m, n) > ^^wco('^ -I- 1, m -I- 1, n + 1) trivially 
hold, since increasing the number of messages will not allow lower error probabilities, and a strategy with n + 1 
messages and m -I- 1 fingerprints can be constructed from one with n messages and m fingerprints, by simply allowing 
Alice to pass on the additional message to Roger as the additional fingerprint. 



C. Generalizations and the SMP model: niA = ms 



We now apply some of the ideas of the previous section to the general case where Bob's fingerprint set is also 
restricted in size. Defining index sets for Alice's and Bob's fingerprinting strategies 

/(f) ^ {a I p{a\x) > 0} , EE {b I qib\y) > 0} , (26) 

a binary strategy is one with 

I 0, otherwise 

After inspection of Eq. JSJ it is straightforward to see that Lemma !2! of the previous section takes the following 
generalized form. 

Lemma 12. Let {p,q,r) be a binary fingerprinting strategy. Then P^Jcc'^^ = ^ ^ff I-iF^ x ly^"^ Q Uz /i^"* x /i'''' for 
some X y. 
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A necessary condition for P^'c'^^ < 1 is to have both famihes of sets X^p^ = {/i''^} and X^''^ = {/y"^^} forming 
antichains. Note however, that a different labeUing of members in one of the famihes (through subscript x or y) 
will, in general, correspond to a different strategy; consequently, the enumeration of elements in X^p^ and X^*^ is now 
important. 

Lemma 1121 may be used to derive conditions upon which the worst-case error probability is necessarily 1, thus 
generalizing Theorem0]of the previous section. We may also generalize Theorem^] however, in the following straight- 
forward manner. Setting m = mm{mA,mB}, we first note that Theorem 0] implies ^l^^^{n,mA,mB) — 1 whenever 
n > (|^„™2j)' the minimum possible worst-case error probability cannot decrease when the size of Bob's message 
pool, tob, is decreased. We now claim that in fact the converse is also true. That is, whenever ^^^^(n,mA,'mB) = 1 
we must have n > (l„j"2j)' '-'^ equivalently, ^l,^^{n,m,m) < 1 when n — (|^^/2j)- Explicit examples of such strategies 
will prove our claim. Consider the binary strategies with X^p' — (^,[™2j) (^^y labelling of elements in this family 

will do) and then ijf^ = llf' , the complement of I^"^ in [m\. Roger's decisions are dictated by Eq. H27|l. and hence, 

r(a,b) = 1 — 5{a,b). Finally by choosing, for example, p{a\x) = 1/[to/2J when a g /i;^^ (otherwise zero), and 

q{h\y) = l/\m/2\ when b £ 4"^^ = 4^^', we find that Pi^ce'"'^ = 1 - l/{[m/2\ \m/2]) < 1 and the following theorem 
is proven. 

Theorem 13. ^^^^{n.,mA,TnB) < 1 iff n < (^„™2j) where m = minimal, tob} . 

The generalization of other results from the previous section was found to be quite difficult. We can say some more, 
however, about the special case of Alice and Bob sharing the same set of fingerprints, i.e. when niA = ttib = m. In 
particular, the strategy given above can be shown to be optimal: 

Proposition 14. ^;,,(n,m,m) = 1 - l/(Lm/2j \m/2-]) if n - {^^;^^^^) . 

To see how to show this, consider the case when m is even. Since n = ' ^^"^ only choice for X'p-' and X^^^ is 

the antichain (,[["2) • must now decide how to optimally label the index sets g X^^^ and ly'^^ G X'^'?^ . There is 

in fact only one choice, modulo permutations of message and fingerprint labels, for which I'i'^ x /y"^' ^ Uz /i^'' x /i'-* 
for every a; 7^ y, and by Lemma 1121 allows a worst-case error probability less than 1. One can show that for any 
labelling of the index sets, every row and every column of the m x m matrix r(a, b) has at least m — 1 entries equal 
to 1. The condition for the worst-case error probability to be less than 1 can be satisfied only for those matrices with 
a in every row and every column i.e. r{a,b) is a row/column permutation of the m x m matrix with a diagonal 
of O's, and off-diagonal elements equal to 1. Such strategies correspond to a message and/or fingerprint relabelling 
of the strategy given above, and are optimal when the nonzero transmission probabilities of p(b\x) and q(b\y) are 
symmetrically chosen to be 2/m. The case when m is odd is similar. 

In principle, we can also use Lemma lT^ in this way to locate an optimal strategy for other n. One must, however, test 
all possible choices for X^p' and X^''^ , i.e., all antichains of length n, which grow exponentially in number as n decreases. 
Consequently, this laborious task was undertaken only for two special cases, with results: ^^(,(,(5,4,4) = 3/4 and 
^i,e(9,5,5) = 5/6. 

In Table Hill we report the known values of £Pl^^^{n,m,m), or the range of possible values when unknown. Apart 
from the above special cases where the exact value of ,!3^^j,g(n, m, m) was derived, all lower bounds are the same as 
those given in the previous section, being derived from the inequality ^^^^(n,m,m) > ^l^^^(n,m,n). Such bounds 
are likely to be weak in general. 

The upper bounds on ^l,cei''^t ™j ™) Table Hill come from explicit strategies. First note that we will always have 
I^^^^(2n, 171 + 71,171 + 12) < ^^^^(n, TO, n). This follows from a straightforward conversion of an (n, m, n)-fingerprinting 
strategy of the previous section, denoted by (p', r') say, into a strategy suitable for employment in the current scenario: 
Previously, Alice performed the fingerprinting strategy p' , while Bob simply acted as a relay, and passed his message 
on to Roger. To covert this strategy into one suitable for the current scenario, we ask Alice to employ p' on the first 
half of Sapna's messages and relay the second half, while Bob is tasked with the opposite, fingerprinting on the second 
half and relaying on the first. Explicitly, 

. I , I p'(a\x), if 1 < a < m and 1 < x < n 

I d(a ~ i7i,x ~ n), otherwise 

I , p'(b\v — n), if 1 < 6 < TO and n + 1 < v < 2n 

^ \ uu ^ .1, " ■ " " • (29) 

I 0(0 — TO, y), otherwise 

Roger may now always discern which half of the message set ({1, . . . , n} or {n + 1, . . . , 2n}) that x and y belong to, 
by simply noting which subdivision a and b belong to ({1, . . . , to} or {m -|- 1, . . . , to + n}), and immediately calls 
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TABLE III: ^ico(w,m,m), the minimum achievable worst-case error probabihty for a classical fingerprinting strategy under 
the SMP model, or the range of possible values when unknown. 



when different, or performs r' appropriately when the same. The resuhing worst-case error probabihty is then equal 
to that for the (rt, m, n)-strategy {p',r'). In Table UTTl the upper bound ,^4cc(10, 9, 9) < ^1,^^{5,A,5) = 1/2 comes 
from this method. 

To obtain further upper bounds we can consider a variation of the constant-weight-code strategies given in Sec. Ill Bl 
If = {ix'^} and 1*^'^) — {ly^^} are ordered families of, respectively, ki- and fc2-subsets of the m-set, both of size 
n, with the property that 



< J 



(30) 



for all X ^ y, then 3^lj^^[n,m,m) < j/{kik2). The strategies which achieve this worst-case error probability are 
defined by simply setting p{a\x) = 1/fci when a € I^'^ (zero otherwise), and q{b\y) — l/fc2 when b g llf' . Let 
us denote by N2{m, ki, k2, j) the largest n such that a pair of such families exist. The following theorem is then a 
variation of Theorem II II 

Theorem 15. 3^lj^^{n,m,m) < j/(fci/c2) if n < iV2(m, fci, fc2, j) . 

Our own computational searches have found that 7V2(5,2, 2,3) = 8. A strategy with the corresponding worst-case 
error probability of 3/4 is defined through the pair of ordered families with incidence matrices 
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(31) 
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Further computational searches have revealed that iV2(6,2,2, 3) = 12, iV2(6,2,3, 5) = 13, Af2(7, 2,2, 3) = 21 and 
N2{7, 3, 3, 8) > 26. The remaining upper bounds given in Table IITTI follow from these results. 

Finally, returning to the general case, we remark that the lower bounds in Table Ull and upper bounds in Table ITTll 
give respectively, lower and upper bounds on ^^^^.^(n, m^, tob), if we identify m = minjmA, tub} in both tables. This 
follows from the trivial inequality ^4co("i "^A, itib — I) > ^l,c^{n, tjia, tub) > ■^4co('^i + 1; itt-b)- The inequalities 
'^wcc("'+ l,"iyi,ms) > £P^^^{n,mA,rnB) > >^3^wco("' + + l,rnB + 1) also hold in the general case. 



III. QUANTUM FINGERPRINTING 
A. One-way model: niB ~ n 

In the quantum fingerprinting scenario, Alice's and Bob's classical fingerprints (a and b) and probability distributions 
[p(a|a::) and q{b\y)] are replaced by quantum states p{x) e Q(C™-*) and r(j/) e Q(C'"^), respectively, where Q(C'^') = 
|p G End(C'') I p > , tr(p) = l}. Quantum fingerprinting becomes classical when p{x) and T{y) are diagonal in the 
computational basis, in which case we may identify p{a\x) — {a\p{x)\a) and q(b\y) — (&|r(y)|6). 

We will first investigate quantum fingerprinting when = n, in which case Bob encodes Sapna's messages into 
orthogonal quantum states, upon which Roger may perform an orthogonal measurement to unambiguously determine 
the state, and thus y. Though implemented with quantum states, this portion of the fingerprinting procedure is 
eff'ectively classical. Alice, however, must choose her fingerprints from a Hilbert space of dimension ttia ~ m < n. 
Roger's task is then to test whether the state received from Alice, p{x), is p{y) or not, with one-sided error, and 
thus the projective measurement {P{y), 1 — P{y)}^ where Piy) projects onto the support of p{y), is the only suitable 
choice. The worst-case error probability for this strategy is 

Pwcc = max tr [pix)P{y)] . (32) 

x=£y 

It is intuitively reasonable that Alice should fingerprint with pure states, and thus, we will first consider this case. 
The worst-case error probability is then simply the maximal pairwise overlap for Alice's choice of fingerprint states 

mx)m^, c c" : 

Pwcc = max |(V'(x)|V(2/))P . (33) 

Consequently, the minimum possible worst-case error probability will be achieved when Alice chooses her set of 
fingerprint states to have the minimum possible maximal pairwise overlap. Defining the quantity 

6^{n,m) = min max |('0jlV'fc)P , (34) 

{IV'fe>}fc = iCC" 

our goal is to now find sets of n pure quantum states in C™ which achieve the minimum, called optimal Grassmannian 
packings |3j HE ■ We will assume that n > m > 1 in the following. 

Lower bounds on 5'^ (n, m) follow from an isometric embedding of the space of quantum states into Euclidean 
space 0, I23. Each p is first associated with a traceless Hermitian matrix under the correspondence A{p) = 

\J^^^ {P ~ m^)- Endowed with the Frobenius norm \\A\\p = ^/trjATA), the set of all traceless Hermitian ma- 
trices forms a real normed vector space of dimension — 1, in which the images of pure states lie on the unit 
sphere \\A\\f = 1. Through an appropriate parametrization of A, the Frobenius distance for traceless Hermitian 
matrices corresponds to Euclidean distance in R™ For example, taking Xk{A) = tr(AfcA), where the lambda 
matrices Afe (fc = 1, . . . ,r7i^ — 1) form a traceless Hermitian operator basis (see Appendix A of ^^), we find that 
\\A-B\\f = ||a;(^)-£c(P)||2. Consequently, given that for pure states jj A(V') - A((/))||| = ;^(1 - Kf/"!^)!^), abound 

on the maximum possible minimal distance between n points on the unit sphere in ~^ will imply a bound on 
(5^(n, m). 

Packings of points on the unit sphere in K'^ are called spherical codes 28] . The Rankin bounds for spherical 
codes ,29j imply for Grassmannian packings, the simplex bound 24, ..25j 

S\n,m)> """^ (35) 
m(n — 1) 

with equality possible only when n < m^, and the orthoplex bound 

6^(n,m)> — , (36) 
m 
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n\m 


2 


3 


4 


5 


6 


7 


8 


9 


10 


11 


12 


13 


14 


15 


16 


2 















































3 


1/4" 












































4 




1/9" 









































5 


1/2 


.1886 


1/16" 






































6 


1/2™ 


1/5" 


.1071 


1/25" 



































7 


.6051 


2/9" 


1/8" 


.0709 


1/36" 
































8 


.6306 


1/4 


1/7" 


.0871 


.0502 


1/49" 





























9 


2/3 


1/4" 


.1615 


.1025 


1/16" 


.0384 


1/64" 


























10 


.7022 


1/3 


.1687 


1/9" 


.0741 


.0491 


.0299 


1/81" 























11 


.7236 


1/3 


.1808 


3/25" 


1/12" 


.0573 


.0394 


.0238 


1/100" 




















12 


.7236 


1/3™ 


.1830 


.1277 


1/11" 


.0651 


.0456 


.0319 


.0193 


1/121" 

















13 


.7713 


.3871 


3/16" 


.1351 


.0972 


.0714 


.0522 


1/27" 


.0265 


.0163 


1/144" 














14 


.7820 


.4066 


1/5 


.1411 


.1026 


1/13" 


.0577 


.0429 


.0310 


.0222 


.0138 


1/169" 











15 


.7963 


.4141 


1/5 


.1452 


.1072 


4/49" 


1/16" 


.0476 


.0357 


.0262 


.0189 


.0118 


1/196" 








16 


.8061 


.4196 


1/5" 


.1506 


1/9" 


.0857 


1/15" 


.0519 


1/25" 


.0303 


1/45" 


.0162 


.0101 


1/225" 





17 


.8140 


.4282 


1/4 


.1549 


.1154 


.0893 


.0703 


.0556 


.0438 


.0341 


.0261 


.0196 


.0141 


.0089 


1/256" 


18 


.8243 


.4395 


1/4 


.1581 


.1194 


.0926 


.0735 


1/17" 


.0471 


.0374 


.0294 


.0227 


.0173 


.0123 


.0079 


19 


.8366 


.4576 


1/4 


.1581 


.1220 


.0954 


.0764 


5/81" 


1/20" 


.0404 


.0324 


.0257 


.0199 


.0154 


.0111 


20 


.8382 


.4712 


1/4™ 


.1581 


.1254 


.0983 


.0790 


.0643 


1/19" 


.0431 


.0351 


.0284 


.0226 


.0176 


.0137 


21 


.8497 


.4733 


.2890 


4/25" 


.1271 


.1011 


.0813 


.0667 


.0550 


.0455 


.0375 


.0308 


.0250 


.0200 


1/64" 


22 


.8552 


.4948 


.2979 


1/6 


.1293 


.1039 


.0835 


.0688 


.0571 


.0476 


.0397 


.0330 


.0272 


.0222 


.0179 



TABLE IV: The smallest known maximal pairwise overlap for sets of n pure states in C™. Entries in boldface signify that 
the overlap is optimal. This is the case for all ETFs (denoted by a superscript e) and MUBs (jn). Each maximal overlap is 
also an achievable worst-case error probability for a quantum fingerprinting strategy under the one-way communication model 
(ms = n), with the entries in boldface being the minimum achievable. 



if n > m^, with equality possible only when n < 2[vn? — 1). 

The simplex bound was derived by Welch [s^l and also appears in the context of frame theory [25 IsH where a set 
of states which achieves equality is called an equiangular tight frame (ETF). This name derives from the fact that 
equality will occur if and only if ||22| 

l(^.IV'.)l^ = ^P^, (37) 
m[n — 1) 

for all i ^ k, which automatically guarantees a tight frame: J^k l'0fe)(V'fe| = ^I- Trivial examples of ETFs occur 
when n = m (basis in C™) and n — m + 1 (vertices of the simplex in R"'). Excluding these cases, it is necessary 
that n < min {m^ {n - m)2} for an ETF to exist [Hip. This condition, however, is far from sufficient. In Table Hvl 
we give all known examples of an ETF for small m and n. Here we tabulate upper bounds on (5^(n,m). The entries 
in Table HVl marked by a superscript e signify cases where an analytical construction of an ETF is known. These 
derive from quadratic residues Is^ Issll . conference matrices [2^ [^ [sS HE IP > Hadamard matrices Isil Ir^I . g raphs 
[siL Ib^ [p, and difference sets |34l l85l| . Finally, an ETF is conjectured to exist whenever n = jS.'l with 
analytical constructions for m < 8 and m = 19 fsslls^ [iolllll li ^ . 

Given the simplex bound on 5^(n, m) [Eq. (|35|l ]. we know that all ETFs, when they exist, are optimal Grassmannian 
packings. Sets of mutually unbiased bases (MUBs) ^3 ^^so give optimal Grassmannian packings. It is known that 
when m is a prime power, a maximal set of m -I- 1 MUBs exists (i.e. n = m? + m) with constant overlap of 1/m 
between elements of different bases, thus saturating the orthoplex bound [Eq.lSHj- In Table Hvl the MUBs are marked 
by a superscript m. 

When m — 2, the above embedding maps quantum states surjectively into the unit ball in (realizing the Bloch- 
sphere representation of a qubit), and our problem is exactly equivalent to finding optimal spherical codes in three 
dimensions. Collections of putatively optimal spherical codes can be found online [44| , and have the maximal overlaps 
in the first column of Table HVl Of these, only in the cases n < 14 has optimality been established (see ^EO)- ^'^^ 
n = 4, 6, 8, and 12, the optimal spherical codes are given by the vertices of a regular tetrahedron, regular octahedron, 
square antiprism, and regular icosahedron, with maximal over laps 6^ = 1/3, 1/2^3 + V2)/7, and (1 + l/V5)/2, 



respectively |23|. Except for n = 8, optimality follows from the Fejes Toth bound [43: 5 {n, 2) > ^ esc 



4"-='^ L6(n-2)J 
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All other entries in Table HVl are the overlaps for the best packings found in a numerical search, and thus, optimality 
is not guaranteed. In many cases, however, the given overlap almost saturates the simplex bound and thus must be 
at least very close to optimal. 

When iriB — n, each of the maximal overlaps in Table HVl is the worst-case error probability for a quantum finger- 
printing strategy. Comparing these to the classical error probabilities in Tabled we see that quantum fingerprinting 
strategies generally outperform classical strategies by a sizeable margin. Note, for example, that when n = q{q + 1), 
where g is a prime power, there exists a classical constant-weight-code strategy [see Eq. (|25|) ] which requires m = 
fingerprints to obtain a worst-case error probability of Pwcc — l/?- This class of classical strategies is optimal for at 
least q = 2 and 3. There exist ETFs, however, with the parameters m — q^ and n = q{q + 1) -I- 1 (when q is a prime 
power) having equiangular overlaps of 1/q'^ j34|. Consequently, for the same m and n, the classical worst-case error 
probability above may be reduced to Pwcc — l/'J'^i or less, using quantum fingerprints. Taking a different approach, 
if we instead fix n = q{q + 1) and Pwco — ^/q, we know that a quantum MUBs strategy exists which achieves this 
performance using only m — q fingerprints. Finally, the quantum performance gain is far more impressive if we 
instead fix m and Pwco- For example, in the classical case, when m = 4 we know that to achieve Pwcc = 1/2 it is 
necessary that n < 6. A numerical search, however, finds that there exists a set of n 4-dimensional quantum states 
with a maximum pairwise overlap of 1/2, or less, for all n < 75. Thus, quantum fingerprinting strategies can map at 
least 75 messages into 4 fingerprints while retaining a worst-case error probability Pwcc < 1/2, compared to only 6 
messages classically. 

In the above analysis we have assumed that Alice's fingerprint states are pure. Under this restriction, each boldfaced 
error probability in Table Hvl is the minimum possible. Suppose now that Alice is allowed to choose mixed quantum 
states for her fingerprints. When m = 2, it is clear from Eq. H32|l that pure states remain the only valid choice if she 
is to retain Pwce < 1, since any mixed qubit has support on the entire Hilbert space. Consequently, each boldfaced 
entry in the first column of Table HVl is the minimum achievable worst-case error probability over all (mixed or pure) 
quantum fingerprinting strategies. We will conclude this subsection by proving that the remaining boldfaced error 
probabilities in Table Hvl are also the minimum achievable. 

Define the quantity 

A^{n,Tn) = min max tr (pjPk) . (38) 
{Pfc}J^iCQ(C"«) 

By considering the choice pk = I/m for all fc, wc immediately arrive at the upper bound A^(n,m) < l/m. We will 
now show that the Rankin lower bounds on the maximum pairwise overlap for a set of pure quantum states [Eq. 's H35|) 
and H3t)|l ] also apply to general quantum states. First note that 

1 Tfl — 1 

tr {p,pk) = - + tr [A{pj)A{pk)\ (39) 



under the correspondence A{p) — y ^J" (p — . In the context of deriving lower bounds on A^(n, m), we need only 

consider sets of quantum states with tr [A{pj)A{pk)\ < for all j ^ fc, since otherwise the maximum pairwise overlap 
is greater than l/m, which exceeds the upper bound. Assuming tr [A(pj)A(/9fe)] < 0, and given that ||^(p)||i? < 1 for 
any quantum state, we see that 

tr \A{p,)A{p^)\ > tr [A{p,)A{pk)] = 1 - i||i(p,) - A(pk)\\l , (40) 

where the rescaled A{pk) = A{pk)/\\A{pk)\\F satisfy ||v4(/9fe)||F = 1- Thus, under the above isometric embedding into 
(m^ — l)-dimensional Euclidean space, the Rankin bounds on spherical codes [29l| imply that 

A\n,m)>— -, 41 

m(n — 1) 



and 



A'(n,m) = l, (42) 
m 



if n > m^. Equality in the latter follows from the upper bound. 

Finally, denoting Alice's fingerprint states by p{x), and the support of p{x) by P{x), the worst-case error probability 

Pwco = max tr [p(a:)P(y)] (43) 

> m.axtr[p{x)p{y)] (44) 

> A2(n,m) , (45) 
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and consequently, each boldfaced error probability in Table IIVI is in fact the minimum achievable worst-case error 
probability over all (mixed or pure) quantum fingerprinting strategies. 



B. Generalizations and the SMP model: tua = niB 



Now consider quantum strategies under the general fingerprinting scenario {mA,mB < n). If Alice sends state p{x) 
for message x, and Bob sends r(y), then, given the one-sided-error constraint, it is straightforward to see that Roger's 
optimal measurement on the product state p{x) (8) T(y) to determine whether x — y, is the projective measurement 
{Pi,Pq = 1 — Pi}, where Pi projects onto the support of Pi = P(^) ^ '''i^)- The worst-case error probability is 
then 

Pwcc = max tr [p{x) (E) T(y)Pi] . (46) 

x=£y 

It remains to find good choices for p{x) and T(y). For simplicity, we will restrict our study to strategies where the 
fingerprint states are pure, p{x) = \'ip{x)){ip{x)\ and T{y) ~ 1 0(2/)) ('/'(j/) I say. 

Consider the case where niA = niB = rn, and suppose Alice and Bob map messages onto the same set of fingerprint 
states, {\'tp{x))}2=i C C™ say. If Roger, instead of choosing to project onto the support of IV'(-2))(V'(-z)l ^ 
\i{j{z)){i{j{z)\, fixes Pi = Ilsyin = b\^)i^\ ® + ® ^hc projector onto the symmetric subspace of 

C" (g) C" , then the resulting worst-case error probability is 

Pwcc = maxi(l + |(^(a;)|^(2/))P) . (47) 

The optimal Grassmannian packings described in the previous subsection are now the best choices for W'\\){x))Yi~=\- 
Although the minimum possible worst-case error probability is bounded below by one half, Pwce = ^[1 + S^{n^vn)\ > 
1/2, these strategies were found to give the best error rates when n > ^m{m + 1), the dimension of the symmetric 
subspace. 

We now describe analytical constructions of quantum fingerprinting strategies from ETFs under the SMP model. 
For an ETF, the strategy just described has Pwce = 5 [-'^ m(n-\) ] ■ However when n < ^■m{m + 1) we can obtain 
smaller worst-case error probabilities in the following way. Suppose the set {|Cj)}j=i forms an ETF in C™. We choose 
\ip{x)) = \^x) and {(t^iy)) = \Cy*)j for Alice's and Bob's fingerprint states respectively, where conjugation is done in 
the computational basis. Note that Pi = J2z I'^i'^)) \ ^ I'Piz)) {<P{z)\ is the sum of n rank-1 operators, and hence, 
has rank no greater than n. Using the defining property of an ETF [Eq. H37|l ]. it is straightforward to verify that the 
n states 



IS,) ^ /^^(!^) ^e^|^,)«|^/), k = l,...,n-l, (48) 
y n'^[fn— 1) 



(49) 



are orthonormal and belong to the support of Pi. Consequently, these states span the support of Pi, and Roger's op- 
timal measurement has Pi = X]fc=i The worst-case error probability for the strategy may now be calculated 

2 _ 2 

in a straightforward manner. The result is Pwce = ^-ii 

o wee m^(n— 1) 

When n = 2m, ETFs can be used to obtain even smaller worst-case error probabilities. Suppose again that the set 
{|Cj)}j=i forms an ETF in C™. Define the m x n matrix with entries Xji^ = ■y/^(j|Cfc)- The tight frame condition, 
12k l^fc)(^fe| = implies that the rows of X are orthonormal: XX'^ = I. Thus, another n~m rows may be appended 
to form an n X n unitary matrix U ~ [y] , where XY^ ~ YX^ ~ and YY^ ~ I. This last relation implies that a 
tight frame in C"^™ may be constructed from the columns of Y by setting {j\xk) — \J n-rn ^i''' '^^'^'^ set {\xj)}^=i is 
in fact an ETF. This follows from the unitarity oiU: I = WU = X'<X + r+r, i.e. 6jk = f (Ol^fc) + ^(XjIXfc)- 
Thus, when j ^ k we have |(xjlXfe)P = („"^)d (OI6)P = 1) 7 which is the defining property of an ETF in 

C"-™. We have shown that the existence of an ETF in C™ guarantees the existence of an ETF (of equal size) in 
C""™ ■ Note that for the special case n = 2m, the second ETF also belongs to C™. Importantly, again from 
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n\m 


2 


3 


4 


2 











3 


5/8" 








4 


2/3" 


7/27" 





5 


3/4 


.4330 


9/64" 


6 


3/4™ 


7/15" 


.2494 


7 


.8025 


11/18" 


.3398 


8 


.8153 


5/8 


5/14" 


9 


5/6 


5/8" 


.4962 


10 


.8511 


2/3 


.5567 


11 


.8618 


2/3 


.5904 


12 


.8618 


2/3™ 


.5915 


13 


.8857 


.6935 


19/32" 


14 


.8910 


.7033 


3/5 


15 


.8982 


.7071 


3/5 


16 


.9031 


.7098 


3/5" 


17 


.9070 


.7141 


5/8 


18 


.9122 


.7198 


5/8 


19 


.9183 


.7288 


5/8 


20 


.9191 


.7356 


5/8™ 


21 


.9249 


.7367 


.6445 


22 


.9276 


.7474 


.6490 



TABLE V: The smallest known worst-case error probabilities for a quantum fingerprinting strategy under the SMP model 
(rriA = ms = m). 



the unitarity of U, the inner products of the ETF pair satisfy (xjlxk) = ~{^j\S.k) for j ^ k. Using this relation and 
Eq. H37|) , it is straightforward to verify that the n — 1 states 



^ ^^^5]e^lO)®|x/), fc = l,...,n-l, (50) 

are the orthonormal and belong to the support of Pi, where we are choosing \ip{x)) = \^x) and \(t>{y)) — \Xy*) for 
Alice's and Bob's fingerprint states respectively. Unlike in the previous case, J2j ^ \Xj*) = 0, which means 
rank Pi < n — 1. Consequently, Roger's optimal measurement has Pi — '^2=1 \'^k){^k\- The worst-case error 
probability for this quantum fingerprinting strategy is Pwcc = nU2m-i) • 

In Table El putatively optimal worst-case error probabilities are collected for to = 2,3 and 4. Strategies which 
use ETFs or MUBs are marked by a superscript e or to, respectively. When n < ^m{m + 1) some of the analytical 
quantum fingerprinting strategies described above are outperformed by those found numerically, and the corresponding 
numerical worst-case error probability is given instead. Numerical strategies were located by setting Pi to the support 
of Pi = J2z (S> {4'iz)\ as the fingerprint sets {\tp{x))}^^i and {\4'{y))}y=i were varied across Hilbert 

space. Although none of the quantum error rates in Table Ivl can be claimed optimal, the lower bounds on the classical 
error rates in Table ITTll are still surpassed by a fair margin. Again, the performance gain is most impressive when we 
consider to and Pwcc fixed. For example, in the classical case, when to = 4 we know that to achieve Pwce = 3/4 it 
is necessary that n < 6. There exists a set of n 4-dimensional quantum states, however, with a maximum pairwise 
overlap of 1/2, or less, for all n < 75. Thus, quantum fingerprinting strategies can map at least 75 messages into 4 
fingerprints while retaining P^ce < 3/4 [see Eq. (IT7|) ]. compared to only 6 messages classically. 



IV. CONCLUSION 



In this article we have derived lower bounds on the worst-case error probability for a classical fingerprinting protocol 
with one-sided error which are applicable in the small-message limit. These are our main results and the content of 
Theorems 0] HOI and 1131 Although the majority of the lower bounds are tight only in the one-way communica- 
tion model, they also apply to a generalized scenario which encompasses the simultaneous message passing model. 
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Furthermore, the set-theoretic techniques used for their derivation might be of interest from an asymptotic point of 
view. Additionally, we have presented quantum fingerprinting protocols derived from spherical codes, equiangular 
tight frames and mutually unbiased bases, with error rates surpassing the classical bounds. We hope that our work 
provides some important new results applicable to current experimental investigations of quantum fingerprinting 
protocols 0, ^3 . The absolute limits of successful fingerprinting protocols provide quantitative measures for the 
compressibility of information stored in message strings. Our analysis may be appended to the growing list which 
reveal a fundamentally greater capacity to compress data stored as quantum information. 
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